Windows and Virtualization Tips and Tricks

About Me

Franklin Muthuswamy, MCA, M.Tech

Cleveland, Ohio, United States

I am a technical architect with extensive experience in planning, designing, implementing and supporting windows and Virtualization environment. I have sound knowledge and experience in Data Center Virtualization using VMware ESX servers. I am a SME in x86 environments. I hold VMware VCP certification in VSphere 4, MCSE, MCITP, MCTS and ITIL certifications.

1. On the domain controller, click Start – Run and type Ntdsutil in the Open box, and then click OK.

2. Type roles, and then press ENTER.

Note: To see a list of available commands at any of the prompts in the Ntdsutil tool, type ? and then press

ENTER.

3. Type connections and then press ENTER.

4. Type connect to server <GDCPORTAL>, where <GDCPORTAL> is the name of the server you want to use, and then press ENTER.

5. At the server connections: prompt, type q, and then press ENTER again.

6. Type seize <role>, where <role> is the role you want to seize. For example, to seize the RID Master role, you would type seize rid master:

Options are:

7. You will receive a warning window asking if you want to perform the seize. Click on Yes

.

Note: All five roles need to be in the forest. If the first domain controller is out of the forest then seize all roles. Determine which roles are to be on which remaining domain controllers so that all five roles are not on only one server.

· After you seize or transfer the roles, type q, and then press ENTER until you quit the Ntdsutil tool.

Note: Do not put the Infrastructure Master (IM) role on the same domain controller as the Global Catalog server. If the Infrastructure Master runs on a GC server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a GC server holds a partial replica of every object in the forest.

Many of us face challenges while we activate the terminal servers licenses from the remote system. Recently I faced the same issue and I followed the below steps and the problem was resolved.

The Terminal Services Licensing Server must be configured properly and it must be up and running fine on the same network environment. For example, we will consider this server Frank2k3 (192.168.150.100) as a Terminal services licensing server and this server is reachable to the End user system.

If the Terminal Services Licensing Server is present in a different network then we have to enable the required communication ports between two environments. For example if we have the Licensing server present in the network 192.168.150.X and the End user system present in the network 10.50.10.X then we need to enable the following ports from the End user network (10.150.10.X) to the 192.168.150.X network: TCP-135, TCP-139, TCP-445, TCP 5000-5100**.

(The ports range of 5000-5100 can be modified to any other range of at least 100 ports and it should be above the port 1024. I used 5000-5100).

We need to add below entries in the registry (use regedit.exe tool and update the registry). Create the Key in the name of Internet under KEY_LOCAL_MACHINE\Software\Microsoft\Rpc

After update of the above entry in the End user system the new registry key appears as follows: Ports: REG_MULTI_SZ: 5000-5100 PortsInternetAvailable: REG_SZ: Y UseInternetPorts: REG_SZ: Y

Restart End user system. All applications that use RPC dynamic port allocation use ports 5000 through 5100, inclusive. In most environments, a minimum of 100 ports should be opened, because several system services rely on these RPC ports to communicate with each other.

On the End user system, open up Terminal Services Configuration. Click on Server Settings --> License server discovery mode and fill in the IP address of the Terminal Server Licensing Server (192.168.150.100). Clicking on the Check Names button should tell you if it is working or not. Finally click on Server Settings –> Licensing and select Per Device or Per User, to match whatever types of licenses are installed on the licensing server. We used the Per Device license. Everything will work now. If any problem occurs, then check the Licensing server and it will show up in the System event log with event ID 1010.

The end user system (10.50.10.X) will need to be rebooted after these changes.

Optimal design of a VMware View environment must take several factors into consideration. One of the most important factor is the Storage design. When proper storage design planning is not done, it invariably leads to performance issues in the environment. The most prominent example would be having linked clones in an environment in multiple SATA drives with very little cache space. There is a solution for avoiding such performance issues and that is to have fully deployed (thick disk) desktop. Having fully deployed desktops means spreading the I/O over many spindles instead of crowding all requests to one spindle.

This can be done in two methods:

Cloning the Desktop VM

Storage VMotion the Desktop VM

Cloning the Desktop VM

Steps:

1. From VCenter, right click on desktop VM. Select ‘Clone’

2. Keeping continuing with the wizard till the point of selecting what to do with the disk

3. Now select ‘Same Format as Source’

These steps can be done when the desktop is on or off (hot or cold). In a nutshell, the linked clone is read (the latest snapshot of vmdk file that includes all changes down to base disk) and stand-alone disks are created which are independent of the linked clone storage structure. Thus the file created from the cloning is the thick vmdk file which can now be used as base.

The advantage with this method is that one can verify that the cloning is complete before removing the linked clone VM in the View Manager. The new one can be manually added after verification.

Storage VMotion the Desktop VM

Steps:

1. From VCenter, right click on Desktop VM. Select ‘Migrate’

2. Select ‘Change Datastore’

3. Follow the next steps and select ‘Same Format as Source’ in disk section

The VMs are converted just in the same way as the first method with the only benefit that this can be done without any downtime for the desktop.

This method also has the disadvantage of having no verification mechanism and the necessity of free space to be available on another datastore.

The need for a highly secure Strong Password is felt more these days due to increased hacking and phishing. With Microsoft integrating windows logon to many online transactions, the need is further more important.

The password policy setting is one of the most important steps in server hardening procedure. This is usually done in 99% of the environments. But if in any environment it was overlooked, there are methods how one can enforce the strong password policy there.

The steps to enable password security policy in Windows 2003 Domain server is presented in this post: